Expand description
Protected-route HTTP middleware: bearer-token authentication, OAuth-scope
authorization, resource metadata responses, and gateway-subset dispatch
for this crate’s protected MCP routes (protected-routes feature).
Moved here from crates/soma/integrations as a PR 19 review fix.
soma-integrations (product-integration) previously carried this
module behind a protected-http feature that pulled in soma-runtime
and soma-mcp, inverting plan section 3.20’s target dependency shape
(soma-integrations depends on application ports and concrete shared
engines only — auth, observability, client, provider-adapters, gateway,
codemode, openapi — never on the runtime or surface layers built on top
of it) and contradicting this crate’s own gateway.rs, which documents
taking the gateway manager directly “rather than depending on
soma-runtime… keeping this crate’s dependency shape limited”. This
module needs both AppState (already native to soma-runtime, which
also already owns AuthPolicy/build_auth_layer) and soma-mcp’s
McpState/HTTP router, so it lives in soma-runtime behind the
protected-routes feature instead — the crate that was going to own the
AppState half of this either way, now additionally depending on
soma-mcp (a product-surface crate) only under that feature. No
behavior change: bodies are unmodified, only import paths.
Structs§
- Protected
McpState - State for the protected-MCP-route interceptor middleware: pairs the
composition root’s
AppStatewith the MCP transport’sMcpStatethe gateway-subset dispatch path needs. Fields stay private; construct viaProtectedMcpState::new.